Sigma detection rules, expert-reviewed

Suspicious Logon Event Enumeration via wevtutil via process_creation

This rule detects use of wevtutil to query security logon event IDs 4624 and 4672 for account and session hunting. Stately Taurus queried these events with wevtutil to map successful and privileged logons on compromised Southeast Asian government hosts, indicating attacker log enumeration during lateral movement preparation.

Suspicious Stately Taurus Masqueraded Service and Task Persistence via process_creation

This rule detects creation of services or scheduled tasks and run keys using the impostor names DISMsrv and TabletPCInputServices that mimic legitimate Windows components. Stately Taurus (Mustang Panda) established persistence for ToneShell and ShadowPad under these masqueraded names, so seeing them via service, task or registry tooling indicates attacker persistence.

Malicious InternalMonologue NTLM Downgrade Execution via process_creation

This rule detects execution of the InternalMonologue tool that abuses NTLM authentication downgrade to retrieve Net-NTLM responses without touching LSASS. Alloy Taurus used InternalMonologue to gather NTLM material during their government intrusion, making the tool name a reliable credential-access indicator.

Suspicious Stored Credential Enumeration via cmdkey via process_creation

This rule detects use of cmdkey with the list flag to enumerate stored Windows credentials in Credential Manager. Alloy Taurus ran cmdkey list alongside other credential discovery during their intrusion, so this command from an interactive or scripted context is an indicator of an attacker harvesting cached logon material.

Suspicious ProcDump LSASS Memory Dump via process_creation

This rule detects use of ProcDump to capture the memory of the LSASS process for offline credential extraction. Alloy Taurus operators dumped LSASS with ProcDump during their campaign against a Southeast Asian government target, and while ProcDump is a legitimate Sysinternals tool this specific target makes it a strong credential-access signal.

Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation

This rule detects command execution that writes reconnaissance output to the result2.dat file under the Windows Temp directory. Turla (Pensive Ursa) Kopiluwak dropper stages the results of systeminfo, tasklist, net, ipconfig and dir enumeration into this hardcoded artifact, so this combination reveals staged host discovery ahead of follow-on tasking.

Suspicious Named Pipe Access for Authentication Coercion (via pipe_created)

This rule detects access to the RPC named pipes abused by authentication coercion techniques such as PetitPotam and PrinterBug to force a target into authenticating to an attacker-controlled server. The spoolss, efsrpc, and eventlog pipes expose dangerous opnums that trigger outbound NTLM authentication. Detecting connections to these pipes surfaces coercion attempts that feed NTLM relay and privilege escalation.

Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel

This rule detects creation of named pipes whose names end in the Kazuar command channel suffixes PING, TASK or LOGS used by the Pensive Ursa (Turla) backdoor to coordinate injected components. Kazuar derives the pipe prefix from the machine GUID and appends fixed command keywords which reveals its interprocess control mechanism after injection into explorer.exe or svchost.exe.

Suspicious Outbound Connection to TuxBot Botnet C2 Ports

This rule detects an outbound network connection to destination port 1999 or 31337, the fixed command-and-control ports used by the TuxBot v3 IoT botnet framework. These ports carry the botnet magic-byte protocol that tasks infected devices. Detecting connections to them surfaces likely bot check-in traffic worth investigating.

Suspicious MQTT Command and Control Connection by WikiLoader

This rule detects outbound network connections to MQTT broker ports used by a unique WikiLoader variant for command and control after a spoofed GlobalProtect infection. Repurposing the MQTT messaging protocol provides a resilient channel that many defenses do not inspect. Detecting connections on these ports from endpoints exposes potential WikiLoader beaconing.

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

This rule detects GlobalProtect gateway connections carrying the hard-coded device names and placeholder MAC addresses embedded in public proof-of-concept code for PAN-OS CVE-2026-0257. Presence of these exploit-specific constants indicates an attempt to abuse the flaw for unauthenticated access.

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

This rule detects Intune remote wipe and factory reset actions in Microsoft 365 audit logs, a destructive technique associated with Handala-linked wiper operations that abuse device management to erase endpoints at scale. Mass remote wipe actions cause widespread data and availability loss, so such events outside authorized decommissioning should be investigated urgently.

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Detects execution of GoldenDMSA.exe with command-line indicators consistent with wordlist/bruteforce directory account manipulation.

Windows Security: Kerberos 4771 Pre-Authentication Failures for Machine Account Password Guessing

Triggers on Kerberos pre-authentication failures (4771) for machine accounts using status codes 0x19/0x18.

Suspicious Exchange Inbox Forwarding Rule Creation via M365 (via m365)

This rule detects creation or modification of Exchange inbox rules that forward or silently delete messages, a hallmark of the Jingle Thief gift card fraud campaign. The actors hide fraud-related correspondence by auto-forwarding and moving sent items to Deleted Items. Detecting this rule change exposes mailbox manipulation used to conceal ongoing business email compromise.